« Volver al listado

CVE-2012-1792

Estado: ModificadaBaja (2.6)—

Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce/index.php, which is not properly handled in an error message. NOTE: this might not be a vulnerability, since the ability to access oscommerce/index.php during installation may already imply administrator privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Oscommerce — Online Merchant

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-1792",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-05-27T19:55:01.093",
  "references": [
    {
      "url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2012-005.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2012-005.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce/index.php, which is not properly handled in an error message.  NOTE: this might not be a vulnerability, since the ability to access oscommerce/index.php during installation may already imply administrator privileges."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php en OSCommerce Online Merchant v3.0.2 cuando el software está siendo instalado, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro de nombre de oscommerce / index.php, que no se maneja adecuadamente, en un mensaje de error. NOTA: esto podría no ser una vulnerabilidad, ya que la capacidad de acceder a oscommerce / index.php durante la instalación ya puede implicar privilegios de administrador."
    }
  ],
  "lastModified": "2026-06-16T23:40:19.013",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oscommerce:online_merchant:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2BA6507A-8902-4818-8408-188544AEE9B4"
            },
            {
              "criteria": "cpe:2.3:a:oscommerce:online_merchant:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "297499B5-430E-44F5-8140-644AC16771C0",
              "versionEndIncluding": "3.0.2"
            },
            {
              "criteria": "cpe:2.3:a:oscommerce:online_merchant:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C304E88C-9904-4DAE-BE7B-7E450574F0EB"
            },
            {
              "criteria": "cpe:2.3:a:oscommerce:online_merchant:2.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2973F415-42D4-4B5F-B6FB-B610D6F0719E"
            },
            {
              "criteria": "cpe:2.3:a:oscommerce:online_merchant:2.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27DE7428-0AAE-42F8-BC28-5FEC86A463E7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}